Radius&Tacacs 安装及客户端交互示例

FreeRadius

1.安装
官网wiki地址：https://wiki.freeradius.org/guide/Getting%20Started
安装命令：apt-get install freeradius
service freeradius restart
freeradius -X 可以实时监听freeradius运行状况
测试服务是否成功radtest tiger hello 127.0.0.1 0 testing123
2.配置文件路径
/etc/freeradius

配置users："test" Cleartext-Password := "hello"   #用户和密码
Reply-Message = "Hello, %{User-Name}"
配置clients.conf：
client 192.168.3.0/24 {
	secret = test123  //约定秘钥
	require_message_authenticator = no
	nastype  = other
}
client 192.168.3.10 {
		ipaddr=192.168.3.10
		secret = 123
		require_message_authenticator = no
		nastype     = other
}//上面的生效

3.client
python扩展https://github.com/pyradius/pyrad

python3 setup.py install

Example:

####
#!/usr/bin/python
from __future__ import print_function
from pyrad.client import Client
from pyrad.dictionary import Dictionary
import socket
import sys
import pyrad.packet
srv = Client(server="192.168.3.10", secret=b"test123", dict=Dictionary("dictionary"))
print(srv)
req = srv.CreateAuthPacket(code=pyrad.packet.AccessRequest, User_Name="test")
print(req)
req["NAS-IP-Address"] = "192.168.3.10"
req["NAS-Port"] = 0
req["Service-Type"] = "Login-User"
req["NAS-Identifier"] = "hello"
req["Called-Station-Id"] = "00-04-5F-00-0F-D1"
req["Calling-Station-Id"] = "00-01-24-80-B3-9C"
req["Framed-IP-Address"] = "127.0.0.1"

try:
    print("Sending authentication request")
    reply = srv.SendPacket(req)
except pyrad.client.Timeout:
    print("RADIUS server does not reply")
    sys.exit(1)
except socket.error as error:
    print("Network error: " + error[1])
    sys.exit(1)

if reply.code == pyrad.packet.AccessAccept:
    print("Access accepted")
else:
    print("Access denied")

print("Attributes returned by server:")
for i in reply.keys():
    print("%s: %s" % (i, reply[i]))
~                                                                                                                                                                                           
~            
#####

Tacacs

1.Tacacs安装

apt-get install tacacs+

创建配置文件，/etc/tacacs+/tac_plus.conf ，内容如下：
#Make this a strong key,共享密钥

key = 12345678
#*************************
#***   GROUPS HERE     ***
#*************************
group = Network_Engineers {
        default service = permit    #这个选项是授权(Author)使用的
        login = file /etc/passwd    #使用系统的用户名和密码验证机制
        enable = file /etc/passwd
}
user = test{
        member = Network_Engineers
}
user = test {
        member = Network_Engineers
}
user = alice {
        default service = permit
        login = des "9XmWlJh.hMoLM" 
#1:使用命令tac_pwd 2:输入密码：test 3:生成密码
}

2.运行

sudo tac_plus -C /etc/tacacs+/tac_plus.conf -t -d 1

实时查看log

tail -f /var/log/tac_plus.log

3.Client
python使用扩展

pip3 install tacacs_plus

Example:

#####
#!/usr/bin/env python
from __future__ import print_function

from tacacs_plus.client import TACACSClient
from tacacs_plus.flags import TAC_PLUS_ACCT_FLAG_START, TAC_PLUS_ACCT_FLAG_WATCHDOG, TAC_PLUS_ACCT_FLAG_STOP
import socket

# For IPv6, use `family=socket.AF_INET6`
cli = TACACSClient('192.168.3.10', 49, 'tackey', timeout=10, family=socket.AF_INET)

# authenticate user and pass
authen = cli.authenticate('alice', 'pass1')
#s=authen.server_msg
#print(authen)
#print(s)
#ss = s.decode('utf-8')
#print(ss)  
#sss = ss.encode()  
print(authen.valid)
print("PASS!" if authen.valid else "FAIL!")
#####